1 files changed, 818 insertions, 145 deletions

diff --git a/src/rpc.cpp b/src/rpc.cpp
index 813f1d1..8af2fbe 100644
--- a/src/rpc.cpp
+++ b/src/rpc.cpp
@@ -6,8 +6,8 @@
 // Architecture:
 //   PoolEventLoop  -- single thread, owns all miner fds, all job/share/payout
 //                     state. No locks needed on any of that data.
-//   AcceptOneFn    -- one thread per relay. Blocks on RvServiceRegister +
-//                     BtfServiceWrap, pushes finished socket to gReadyQueue.
+//   AcceptOneFn    -- one thread per relay. Registers, waits to be paired,
+//                     wraps the tunnel, pushes finished socket to gReadyQueue.
 //   AcceptLoopFn   -- spawns AcceptOneFn threads, re-polls relay list every
 //                     60s so dynamically discovered relays get picked up.
 //
@@ -143,6 +143,75 @@ static bool RebuildJob()
             return false;
         }
 
+        // Don't issue jobs while we are behind the network: mining against a
+        // stale tip produces blocks the network will orphan, and payout
+        // entries that can never be paid (their coinbases never exist on the
+        // main chain). Require at least one peer, and require that no peer
+        // claims a longer chain than ours.
+        if (vNodes.empty()) {
+            LogPrint("pool", "RebuildJob: no peers yet -- not issuing jobs\n");
+            return false;
+        }
+        // This used to compare the tip's timestamp against 30 minutes, which
+        // was wrong in both directions and cost real money.
+        //
+        // It cannot tell "we are not synced" from "the network is slow". A
+        // pool mining its own fork keeps its tip timestamp fresh forever, so
+        // the check passed for the whole of heights 3966-4085 -- 120
+        // consecutive blocks, every one of them orphaned, 5890.50 BTF of
+        // payouts voided. Then, once the pool stopped finding blocks, the
+        // same check refused to issue jobs against a tip that was perfectly
+        // valid and was the network's own best, and the pool -- roughly 90%
+        // of the hashrate -- could not restart the chain it was the majority
+        // of. Stale tip, so no jobs; no jobs, so the tip stays stale.
+        //
+        // The height peers announce in their version message answers the
+        // question the age check was only guessing at. Median, so one peer
+        // claiming an absurd height cannot stall us, and one block of slack
+        // to match WarnIfBehind, because somebody is always mid-relay. A
+        // peer that predates the announcement reports -1 and is ignored; if
+        // nobody has told us anything we mine our best chain, which is what
+        // the node would do without a pool attached.
+        int nPeerHeight = GetPeerMedianHeight();
+        if (nPeerHeight >= 0 && nBestHeight < nPeerHeight - 1) {
+            LogPrint("pool", "RebuildJob: %d blocks behind the network "
+                             "(height %d, peers report %d) -- not issuing jobs\n",
+                     nPeerHeight - nBestHeight, nBestHeight, nPeerHeight);
+            return false;
+        }
+
+        // The comparison above is blind in the one case that matters most.
+        //
+        // When the node goes deaf -- peers still in vNodes, nothing arriving --
+        // no peer announces anything, GetPeerMedianHeight() returns -1, and the
+        // fallback ("nobody has told us anything, so mine our best chain") let
+        // the pool build a private fork for as long as the deafness lasted.
+        // That fallback is right for a node that has simply not been told yet
+        // and wrong for a node that has stopped being able to hear, and a
+        // height nobody sent cannot tell those apart. Time can.
+        //
+        // Deliberately not behind a debug category, and deliberately not a
+        // silent refusal: an operator whose pool has stopped issuing jobs needs
+        // the reason in the log. /poolmineblind is the escape hatch for a node
+        // that really is alone -- without one, a genuinely isolated pool that is
+        // the majority of the hashrate could never restart its own chain, which
+        // is the deadlock the tip-age check used to cause.
+        if (nPeerHeight < 0 && !fPoolMineBlind) {
+            int64 nAge = GetPeerHeightAgeSecs();
+            if (nAge >= BTF_NO_PEER_HEIGHT_MAX_SECS) {
+                static int64 nLastSaid = 0;
+                if (GetTime() - nLastSaid > 60) {
+                    nLastSaid = GetTime();
+                    printf("RebuildJob: no peer has reported a height for %d minutes "
+                           "-- not issuing jobs (our height %d, %d peers connected). "
+                           "This node is deaf; mining now would fork it. "
+                           "Pass /poolmineblind to override.\n",
+                           (int)(nAge / 60), nBestHeight, (int)vNodes.size());
+                }
+                return false;
+            }
+        }
+
         CBlockIndex* pindexPrev = pindexBest;
         unsigned int nBits = GetNextWorkRequired(pindexPrev);
 
@@ -194,7 +263,15 @@ static bool RebuildJob()
                 vector<char> vfAlreadyAdded(mapTransactions.size());
                 bool fFoundSomething = true;
                 unsigned int sz = 0;
-                while (fFoundSomething && sz < MAX_SIZE / 2)
+                // The cap is MAX_BLOCK_SIZE/2, not MAX_SIZE/2. MAX_SIZE is the
+                // 32 MB serialisation ceiling, so half of it is 16 MB -- this
+                // builder would happily assemble a template that its own
+                // CheckBlock() rejects at the 1 MB consensus cap. This is the
+                // pool's job builder, so a block over the cap is not one
+                // wasted solve, it is every miner on the pool working a
+                // template the network will reject. The inner break bounds the
+                // overshoot to a single transaction within a pass.
+                while (fFoundSomething && sz < MAX_BLOCK_SIZE / 2)
                 {
                     fFoundSomething = false;
                     unsigned int n = 0;
@@ -214,6 +291,7 @@ static bool RebuildJob()
                         sz += ::GetSerializeSize(tx, SER_NETWORK);
                         vfAlreadyAdded[n] = true;
                         fFoundSomething = true;
+                        if (sz > MAX_BLOCK_SIZE / 2) break;
                     }
                 }
             }
@@ -251,14 +329,34 @@ static bool RebuildJob()
 // Payouts -- event loop thread only
 // ---------------------------------------------------------------------------
 struct PendingPayout {
-    std::string                  id;
-    int                          blockHeight;
-    int                          matureAtHeight;
+    // The block that funds this payout, identified by hash and not by height
+    // alone. A reorg replaces the block at a height without changing the
+    // height, so a height-keyed obligation outlives the coinbase that was
+    // supposed to pay it: a 280-block reorg once left ~14.4k BTF of debt
+    // owed against blocks that no longer existed, which then drained the
+    // wallet paying fork-era miners out of real-chain coin.
+    //
+    // Upstream keys these on the string "block-<height>". That is the same
+    // bug this fork already paid for, and height keying additionally lets
+    // FindRecordedPoolPayout match the *previous* round's transaction after a
+    // reorg and silently skip a miner, so their `id` is deliberately dropped.
+    int                          blockHeight = 0;
+    // Must be explicitly zeroed: uint256's default constructor is empty
+    // (uint256.h:514), so leaving this unassigned gives every ledger entry
+    // loaded from an older file a garbage hash, which then matches no block
+    // and gets voided as "orphaned". That mistake voided a live payout.
+    uint256                      blockHash = 0;  // zero = entry predates hash keying
+    int                          matureAtHeight = 0;
     std::map<std::string, int64> amounts; // address -> satoshis
+    // From upstream: which recipients already have a transaction. This is what
+    // lets an entry stay on disk until every address in `amounts` is paid,
+    // instead of being erased the moment the batch is handed off.
     std::map<std::string, std::string> paidTxids; // address -> txid
-    int64                        nextAttempt;
-
-    PendingPayout() : blockHeight(0), matureAtHeight(0), nextAttempt(0) {}
+    int                          retries = 0;    // exec-thread only: SendMoney attempts so far
+    int                          deferrals = 0;  // exec-thread only: waits for spendable coin
+    // Upstream's `nextAttempt` is this field under another name; ours is kept
+    // so the retry/deferral policy above stays coherent with it.
+    int64                        retryAfter = 0; // exec-thread only: unix time, 0 = ready now
 };
 static std::vector<PendingPayout> gPendingPayouts;
 static std::mutex                 gPayoutLedgerMutex;
@@ -304,9 +402,25 @@ static std::string PoolRoundsFilePath()
     return GetAppDir() + "/pool_rounds.json";
 }
 
-static std::string PayoutIdForBlock(int blockHeight)
+// Identity of a payout round. Used as the pool-round proof id and, more
+// importantly, as the `pool_payout_id` written into wallet transaction
+// metadata and matched by FindRecordedPoolPayout().
+//
+// Derived from the block HASH, not from its height alone. Upstream uses
+// "block-<height>", which names two different blocks identically across a
+// reorg -- and because this id is what the crash-recovery probe matches on, a
+// height-keyed id lets that probe find the *previous* round's transaction and
+// conclude a miner has already been paid when they have not. The height stays
+// in the string for readability only.
+//
+// A zero hash means the entry predates hash keying; those keep the old form so
+// anything already recorded against them still matches.
+static std::string PayoutIdForBlock(int blockHeight, const uint256& blockHash)
 {
-    return strprintf("block-%d", blockHeight);
+    if (blockHash == 0)
+        return strprintf("block-%d", blockHeight);
+    return strprintf("block-%d-%s", blockHeight,
+                     blockHash.ToString().substr(0, 16).c_str());
 }
 
 static bool PayoutFullyPaid(const PendingPayout& pp)
@@ -317,15 +431,22 @@ static bool PayoutFullyPaid(const PendingPayout& pp)
     return true;
 }
 
-static void SavePendingPayoutsLocked()
+// Serialise the ledger. Caller must hold gPayoutLedgerMutex.
+//
+// Split from the file write so the payout thread can hold the mutex just long
+// enough to read the structure and then do the I/O with it released. Upstream
+// writes the file inside the per-recipient loop with gPayoutLedgerMutex held,
+// while the event loop's FlushMaturePayouts blocks on that same mutex -- one
+// slow fsync per recipient, on the thread the miners' I/O shares.
+static std::string SerializePendingPayoutsLocked()
 {
     nlohmann::json arr = nlohmann::json::array();
     for (const auto& pp : gPendingPayouts) {
         nlohmann::json obj;
-        obj["id"] = pp.id;
-        obj["blockHeight"] = pp.blockHeight;
+        obj["blockHeight"]    = pp.blockHeight;
+        obj["blockHash"]      = pp.blockHash.ToString();
         obj["matureAtHeight"] = pp.matureAtHeight;
-        obj["nextAttempt"] = pp.nextAttempt;
+        obj["retryAfter"]     = pp.retryAfter;
         nlohmann::json amounts = nlohmann::json::object();
         for (const auto& kv : pp.amounts)
             amounts[kv.first] = kv.second;
@@ -336,24 +457,38 @@ static void SavePendingPayoutsLocked()
         obj["paidTxids"] = paid;
         arr.push_back(obj);
     }
+    return arr.dump(2);
+}
+
+// Write the serialised ledger. Holds no lock; safe to call with the mutex
+// released. Atomic tmp+rename so a crash mid-write cannot truncate the record
+// of who is still owed money.
+static void WritePendingPayoutsFile(const std::string& s)
+{
     std::string path = PayoutFilePath();
     std::string tmp = path + ".tmp";
     FILE* f = fopen(tmp.c_str(), "w");
-    if (f) {
-        std::string s = arr.dump(2);
-        fwrite(s.c_str(), 1, s.size(), f);
-        if (fclose(f) != 0) {
-            LogPrint("payout", "[payout] WARNING: could not close %s\n", tmp.c_str());
-            return;
-        }
-#ifdef _WIN32
-        remove(path.c_str());
-#endif
-        if (rename(tmp.c_str(), path.c_str()) != 0)
-            LogPrint("payout", "[payout] WARNING: could not replace %s\n", path.c_str());
-    } else {
+    if (!f) {
         LogPrint("payout", "[payout] WARNING: could not write %s\n", tmp.c_str());
+        return;
+    }
+    fwrite(s.c_str(), 1, s.size(), f);
+    if (fclose(f) != 0) {
+        LogPrint("payout", "[payout] WARNING: could not close %s\n", tmp.c_str());
+        return;
     }
+#ifdef _WIN32
+    remove(path.c_str());
+#endif
+    if (rename(tmp.c_str(), path.c_str()) != 0)
+        LogPrint("payout", "[payout] WARNING: could not replace %s\n", path.c_str());
+}
+
+// Convenience for the cold paths (startup, queueing) where holding the mutex
+// across the write costs nothing. Caller must hold gPayoutLedgerMutex.
+static void SavePendingPayoutsLocked()
+{
+    WritePendingPayoutsFile(SerializePendingPayoutsLocked());
 }
 
 static void LoadPendingPayouts()
@@ -372,17 +507,27 @@ static void LoadPendingPayouts()
         std::lock_guard<std::mutex> lk(gPayoutLedgerMutex);
         for (const auto& obj : arr) {
             PendingPayout pp;
-            if (obj.contains("blockHeight"))
-                pp.blockHeight = obj["blockHeight"].get<int>();
             pp.matureAtHeight = obj["matureAtHeight"].get<int>();
-            if (obj.contains("id") && obj["id"].is_string())
-                pp.id = obj["id"].get<std::string>();
-            if (pp.blockHeight == 0)
+            // Entries written before payouts were keyed by hash carry neither
+            // field. Leave blockHash zero and they are grandfathered past the
+            // orphan check rather than voided on a guess.
+            if (obj.contains("blockHash") && obj["blockHash"].is_string())
+                pp.blockHash.SetHex(obj["blockHash"].get<std::string>());
+            if (obj.contains("blockHeight") && obj["blockHeight"].is_number())
+                pp.blockHeight = obj["blockHeight"].get<int>();
+            // Upstream's tolerance for an entry with no usable height, kept
+            // because it costs nothing and an entry that cannot name its block
+            // is worse than one derived from its maturity. COINBASE_MATURITY
+            // and not COINBASE_SPENDABLE_DEPTH: this reverses whatever the
+            // writer of *that* file used, and only files old enough to lack
+            // blockHeight are affected -- they were written when maturity was
+            // still COINBASE_MATURITY.
+            if (pp.blockHeight == 0 && pp.matureAtHeight > COINBASE_MATURITY)
                 pp.blockHeight = pp.matureAtHeight - COINBASE_MATURITY;
-            if (pp.id.empty())
-                pp.id = PayoutIdForBlock(pp.blockHeight);
-            if (obj.contains("nextAttempt"))
-                pp.nextAttempt = obj["nextAttempt"].get<int64>();
+            // Absent in every file written before this merge; default 0 means
+            // "ready now", which is the right answer for a restored entry.
+            if (obj.contains("retryAfter") && obj["retryAfter"].is_number())
+                pp.retryAfter = obj["retryAfter"].get<int64>();
             for (auto it = obj["amounts"].begin(); it != obj["amounts"].end(); ++it)
                 pp.amounts[it.key()] = it.value().get<int64>();
             if (obj.contains("paidTxids") && obj["paidTxids"].is_object())
@@ -398,6 +543,133 @@ static void LoadPendingPayouts()
     }
 }
 
+// A payment in flight: one record per (payout entry, address) pair, which is
+// the granularity SendMoney works at and therefore the granularity at which a
+// payment can be half-done when the process dies.
+//
+// This list is persisted. It used to be a memory-only queue, and matured
+// entries were erased from pending_payouts.json *before* being handed to it,
+// so any restart in between lost those payments with no record that anyone
+// was owed anything: a container restart on 2026-07-30 silently dropped
+// ~1,156 BTF that way. Writing the records before removing the ledger entry,
+// and reconciling against the wallet on startup, is what makes a restart
+// survivable.
+struct PayingRecord {
+    int         blockHeight    = 0;
+    uint256     blockHash      = 0; // zero = predates hash keying, see PendingPayout
+    int         matureAtHeight = 0;
+    std::string address;
+    int64       amount     = 0;
+    int         retries    = 0;
+    int         deferrals  = 0;
+    int64       retryAfter = 0;
+    // Ask the wallet whether this payment already went out, once, before the
+    // first send attempt. Upstream asks on every attempt: FindRecordedPoolPayout
+    // is a linear scan of mapWallet under cs_mapWallet, per recipient, so with
+    // 2000 rotating payout addresses and a retry budget of 1440 that is a
+    // scan per address per minute for a day. The question it answers -- "did a
+    // previous process send this before it died?" -- can only change across a
+    // restart, and every restart re-sets this flag (ReconcilePayouts), so
+    // asking once per record is the whole of the answer.
+    //
+    // Not persisted: a record read back from disk is by definition a restart.
+    bool        fProbeWallet = true;
+};
+static std::vector<PayingRecord> gPaying; // guarded by gPayoutExecMutex
+static std::mutex                gPayoutExecMutex;
+static std::atomic<bool>         gPayoutThreadRunning{false};
+
+static std::string PayingFilePath()
+{
+    return GetAppDir() + "/paying_payouts.json";
+}
+
+// Caller must hold gPayoutExecMutex.
+static void SavePayingLocked()
+{
+    nlohmann::json arr = nlohmann::json::array();
+    for (const auto& r : gPaying) {
+        nlohmann::json obj;
+        obj["blockHeight"]    = r.blockHeight;
+        obj["blockHash"]      = r.blockHash.ToString();
+        obj["matureAtHeight"] = r.matureAtHeight;
+        obj["address"]        = r.address;
+        obj["amount"]         = r.amount;
+        obj["retries"]        = r.retries;
+        obj["deferrals"]      = r.deferrals;
+        arr.push_back(obj);
+    }
+    std::string path = PayingFilePath();
+    // Write to a temporary file and rename, so a crash mid-write cannot leave
+    // a truncated list of who is still owed money.
+    std::string tmp = path + ".tmp";
+    FILE* f = fopen(tmp.c_str(), "w");
+    if (!f) {
+        LogPrint("payout", "[payout] WARNING: could not write %s\n", tmp.c_str());
+        return;
+    }
+    std::string s = arr.dump(2);
+    fwrite(s.c_str(), 1, s.size(), f);
+    // fclose() is where buffered data actually reaches the OS, so a failure
+    // here means the .tmp is short -- renaming it over the real file would
+    // destroy the good copy. Upstream's check, taken because a truncated
+    // list of who is owed money is exactly what this function exists to
+    // prevent. rename() on Windows will not replace an existing file, hence
+    // the remove() first.
+    if (fclose(f) != 0) {
+        LogPrint("payout", "[payout] WARNING: could not close %s\n", tmp.c_str());
+        return;
+    }
+#ifdef _WIN32
+    remove(path.c_str());
+#endif
+    if (rename(tmp.c_str(), path.c_str()) != 0)
+        LogPrint("payout", "[payout] WARNING: could not rename %s -> %s\n",
+                 tmp.c_str(), path.c_str());
+}
+
+static void LoadPaying()
+{
+    std::string path = PayingFilePath();
+    FILE* f = fopen(path.c_str(), "r");
+    if (!f) return;
+    fseek(f, 0, SEEK_END);
+    long sz = ftell(f);
+    fseek(f, 0, SEEK_SET);
+    std::string s(sz, '\0');
+    fread(&s[0], 1, sz, f);
+    fclose(f);
+    try {
+        nlohmann::json arr = nlohmann::json::parse(s);
+        for (const auto& obj : arr) {
+            PayingRecord r;
+            r.address        = obj["address"].get<std::string>();
+            r.amount         = obj["amount"].get<int64>();
+            r.matureAtHeight = obj["matureAtHeight"].get<int>();
+            if (obj.contains("blockHash") && obj["blockHash"].is_string())
+                r.blockHash.SetHex(obj["blockHash"].get<std::string>());
+            if (obj.contains("blockHeight") && obj["blockHeight"].is_number())
+                r.blockHeight = obj["blockHeight"].get<int>();
+            if (obj.contains("retries") && obj["retries"].is_number())
+                r.retries = obj["retries"].get<int>();
+            if (obj.contains("deferrals") && obj["deferrals"].is_number())
+                r.deferrals = obj["deferrals"].get<int>();
+            gPaying.push_back(r);
+        }
+        LogPrint("payout", "[payout] loaded %zu in-flight payment(s) from disk\n",
+                 gPaying.size());
+    } catch (const std::exception& e) {
+        LogPrint("payout", "[payout] WARNING: failed to parse %s: %s\n",
+                 path.c_str(), e.what());
+    }
+}
+
+// ---------------------------------------------------------------------------
+// Pool round proofs (upstream cbdd06d). Disjoint from the in-flight ledger
+// above -- this is the operator's published record of how a round was split,
+// not an obligation to pay. Both sides added code at this offset; both are
+// kept.
+// ---------------------------------------------------------------------------
 static nlohmann::json PoolRoundToJson(const PoolRoundProof& r)
 {
     nlohmann::json j;
@@ -529,6 +801,88 @@ static void LoadPoolRounds()
     }
 }
 
+// Is the block that funds this payout still on the main chain?
+//
+// A zero hash means the entry was written before payouts recorded one, so
+// there is nothing to check and we assume it is good -- voiding those would
+// mean refusing to pay miners on the strength of a missing field.
+static bool PayoutBlockStillOnChain(const uint256& blockHash)
+{
+    if (blockHash == 0)
+        return true;
+    CRITICAL_BLOCK(cs_main)
+    {
+        std::map<uint256, CBlockIndex*>::iterator mi = mapBlockIndex.find(blockHash);
+        if (mi == mapBlockIndex.end() || mi->second == NULL)
+            return false;
+        return mi->second->IsInMainChain();
+    }
+    return false;
+}
+
+static std::string PayoutComment(int blockHeight)
+{
+    return strprintf("Pool payout height %d", blockHeight);
+}
+
+// Startup reconciliation.
+//
+// This used to be the crash-recovery mechanism: it scanned the wallet with
+// WalletAlreadyPaid() and then dropped ledger entries that had already been
+// exploded into in-flight records. Neither job is right any more.
+//
+// The ledger is now authoritative and an entry survives until every recipient
+// has a txid recorded against it (upstream cbdd06d), so dropping ledger
+// entries here would reintroduce exactly the loss this merge is adopting that
+// model to prevent. And the wallet scan is now FindRecordedPoolPayout(), done
+// once per record on its first attempt, which is the same question asked in
+// the one place that can act on the answer. Running both would be two
+// authorities for the same debt.
+//
+// What is left is the useful part: the in-flight list restored from disk may
+// contain records the ledger already shows as paid (we died between the send
+// and the in-flight file being rewritten). The ledger wins.
+static void ReconcilePayouts()
+{
+    std::lock_guard<std::mutex> exec(gPayoutExecMutex);
+    std::lock_guard<std::mutex> ledger(gPayoutLedgerMutex);
+
+    size_t settled = 0;
+    int64  settledAmount = 0;
+    for (auto it = gPaying.begin(); it != gPaying.end(); ) {
+        bool paid = false;
+        for (const PendingPayout& pp : gPendingPayouts)
+            if (pp.blockHash == it->blockHash && pp.paidTxids.count(it->address)) {
+                paid = true;
+                break;
+            }
+        if (paid) {
+            settledAmount += it->amount;
+            settled++;
+            it = gPaying.erase(it);
+        } else {
+            // Every restored record gets one wallet probe before it is allowed
+            // to send: this is precisely the window where the wallet may hold
+            // a transaction the ledger has not recorded yet.
+            it->fProbeWallet = true;
+            ++it;
+        }
+    }
+    if (settled) {
+        LogPrint("payout", "[payout] %zu in-flight payment(s) totalling %s are"
+                 " already recorded paid in the ledger -- not resending\n",
+                 settled, FormatMoney(settledAmount).c_str());
+    }
+    SavePayingLocked();
+
+    if (!gPaying.empty()) {
+        int64 owed = 0;
+        for (const auto& r : gPaying) owed += r.amount;
+        LogPrint("payout", "[payout] resuming %zu in-flight payment(s) totalling %s\n",
+                 gPaying.size(), FormatMoney(owed).c_str());
+    }
+}
+
 static void RecordPoolRound(const PoolRoundProof& round)
 {
     std::lock_guard<std::mutex> lk(gPoolRoundsMutex);
@@ -559,13 +913,13 @@ static void MarkPoolRoundPaid(const std::string& id,
     }
 }
 
-// Payouts ready to execute are moved here under gPayoutExecMutex.
-// A dedicated thread drains this list so SendMoney (which takes cs_main)
-// never runs on the event loop thread and can't stall miner I/O.
-static std::vector<PendingPayout> gPayoutExecQueue;
-static std::mutex                 gPayoutExecMutex;
-static std::atomic<bool>          gPayoutThreadRunning{false};
-
+// Upstream's gPayoutExecQueue/gPayoutExecMutex/gPayoutThreadRunning are
+// declared above with gPaying: the in-flight list IS the exec queue in this
+// tree, at per-recipient rather than per-round granularity, so a second queue
+// would be a second answer to "who is owed money". Only the dedupe set is new.
+//
+// Ids of rounds currently exploded into gPaying, so a flush cannot queue the
+// same round twice. Guarded by gPayoutExecMutex.
 static std::set<std::string>      gQueuedPayouts;
 
 static bool FindRecordedPoolPayout(const std::string& id,
@@ -595,8 +949,13 @@ static bool FindRecordedPoolPayout(const std::string& id,
     return false;
 }
 
+// blockHash stays a uint256 and not upstream's display string: it is the key
+// this fork's payout ledger is built on, and a key that has been through
+// ToString() is a key that can be compared wrong. It is converted to text only
+// where the round proof needs text. The other three arguments are upstream's,
+// carried for the round-proof data.
 static void QueuePayouts(int blockHeight,
-                         const std::string& blockHash,
+                         const uint256& blockHash,
                          const std::string& coinbaseTxid,
                          int64 coinbaseValue,
                          const std::string& foundBy,
@@ -604,11 +963,11 @@ static void QueuePayouts(int blockHeight,
                          uint64 total)
 {
     PoolRoundProof round;
-    round.id = PayoutIdForBlock(blockHeight);
+    round.id = PayoutIdForBlock(blockHeight, blockHash);
     round.blockHeight = blockHeight;
-    round.matureAtHeight = blockHeight + COINBASE_MATURITY;
+    round.matureAtHeight = blockHeight + COINBASE_SPENDABLE_DEPTH;
     round.createdAt = GetTime();
-    round.blockHash = blockHash;
+    round.blockHash = blockHash.ToString();
     round.coinbaseTxid = coinbaseTxid;
     round.coinbaseValue = coinbaseValue;
     round.foundBy = foundBy;
@@ -639,9 +998,21 @@ static void QueuePayouts(int blockHeight,
     round.operatorReward = operatorCut;
 
     PendingPayout pp;
-    pp.id = round.id;
     pp.blockHeight = blockHeight;
-    pp.matureAtHeight = blockHeight + COINBASE_MATURITY;
+    pp.blockHash   = blockHash;
+    // COINBASE_SPENDABLE_DEPTH, not COINBASE_MATURITY. Paying at depth 100
+    // means the block's own coinbase is still 20 blocks short of spendable, so
+    // the payment has to come out of some *other* mature coin -- the pool runs
+    // a permanent ~19-block float and every payout fails until unrelated coin
+    // matures. The earlier "96% of 934 payments went through at depth 100"
+    // measurement that justified the shorter wait was taken while this node was
+    // alone on a private fork paying itself, so it says nothing about a pool
+    // competing on the real chain. Waiting the extra 20 blocks makes each
+    // payout funded by construction, and puts the maturity gate past the
+    // reorg depth that orphaned 280 blocks of obligations. Upstream uses
+    // COINBASE_MATURITY here; this is a considered disagreement, not an
+    // oversight -- see the merge commit message.
+    pp.matureAtHeight = blockHeight + COINBASE_SPENDABLE_DEPTH;
 
     int skipped = 0;
     int64 burned = 0; // amount owed to miners with bad/empty addresses
@@ -689,37 +1060,222 @@ static void QueuePayouts(int blockHeight,
                         : "");
 }
 
-// Called from event loop: copy matured entries to the exec queue (fast).
-// The ledger entry stays on disk until every recipient has a txid recorded.
-// On restart, FindRecordedPoolPayout() checks wallet metadata before sending,
-// so a crash after SendMoney but before the ledger update does not double-pay.
+// Called from the event loop: explode matured ledger entries into per-recipient
+// in-flight records (fast; no wallet or disk work beyond one small write).
+//
+// The ledger entry SURVIVES here. That is upstream's model and it is the
+// crash-safe one: this fork used to erase the entry as soon as its payments
+// were handed off, so a death in that window left the debt described by
+// nothing at all -- a container restart on 2026-07-30 silently dropped
+// ~1,156 BTF exactly that way. An entry is removed only once every recipient
+// in it has a txid recorded (PayoutFullyPaid), which the payout thread does.
+//
+// gPaying is kept on top of that as the in-flight working set: it carries the
+// per-recipient retry/deferral state that a per-round `nextAttempt` cannot
+// express, and it is what the payout thread iterates. It is a cache of work
+// derived from the ledger, never an independent record of debt -- if it were
+// lost entirely the ledger would rebuild it on the next flush.
 static void FlushMaturePayouts()
 {
+    // Which funding blocks are still on the main chain? Asked with no payout
+    // lock held: PayoutBlockStillOnChain takes cs_main, and cs_main is held by
+    // ProcessBlock and SendMoney for long stretches. Holding the ledger mutex
+    // across it would let the event loop park the payout thread behind a chain
+    // lock it has no interest in. (It is not a deadlock either way -- nothing
+    // takes the ledger mutex while holding cs_main -- but it is exactly the
+    // kind of stall this merge is removing from the ledger path.)
+    std::vector<uint256> orphaned;
+    {
+        std::vector<uint256> hashes;
+        {
+            std::lock_guard<std::mutex> ledger(gPayoutLedgerMutex);
+            for (const PendingPayout& pp : gPendingPayouts)
+                hashes.push_back(pp.blockHash);
+        }
+        for (const uint256& h : hashes)
+            if (!PayoutBlockStillOnChain(h))
+                orphaned.push_back(h);
+    }
+
     std::vector<PendingPayout> ready;
     {
         std::lock_guard<std::mutex> ledger(gPayoutLedgerMutex);
-        std::lock_guard<std::mutex> queue(gPayoutExecMutex);
+
+        // Void obligations whose funding block lost a reorg. The coin that was
+        // meant to pay them does not exist, so paying anyway spends real-chain
+        // coin the pool owes to somebody else.
+        bool voided = false;
+        for (auto it = gPendingPayouts.begin(); it != gPendingPayouts.end(); ) {
+            if (std::find(orphaned.begin(), orphaned.end(), it->blockHash) == orphaned.end()) {
+                ++it;
+                continue;
+            }
+            int64 total = 0;
+            for (auto& kv : it->amounts) total += kv.second;
+            LogPrint("payout", "[payout] block %d (%s) was orphaned -- voiding %zu"
+                     " payment(s) totalling %s\n",
+                     it->blockHeight, it->blockHash.ToString().substr(0, 14).c_str(),
+                     it->amounts.size(), FormatMoney(total).c_str());
+            it = gPendingPayouts.erase(it);
+            voided = true;
+        }
+        if (voided) SavePendingPayoutsLocked();
+
         int64 now = GetTime();
         for (const PendingPayout& pp : gPendingPayouts) {
             if (nBestHeight < pp.matureAtHeight)
                 continue;
-            if (pp.nextAttempt > now)
+            if (pp.retryAfter > now)
                 continue;
             if (PayoutFullyPaid(pp))
                 continue;
-            if (gQueuedPayouts.count(pp.id))
-                continue;
-            LogPrint("payout", "[payout] block height %d matured -- queuing payout %s (%zu recipients)\n",
-                     pp.matureAtHeight, pp.id.c_str(), pp.amounts.size());
             ready.push_back(pp);
-            gQueuedPayouts.insert(pp.id);
         }
-        for (auto& pp : ready)
-            gPayoutExecQueue.push_back(pp);
     }
+
+    if (ready.empty())
+        return;
+
+    std::lock_guard<std::mutex> queue(gPayoutExecMutex);
+    size_t added = 0;
+    for (const PendingPayout& pp : ready) {
+        const std::string id = PayoutIdForBlock(pp.blockHeight, pp.blockHash);
+        if (gQueuedPayouts.count(id))
+            continue;   // already exploded into gPaying and still in flight
+        size_t n = 0;
+        for (const auto& kv : pp.amounts) {
+            // Upstream's per-recipient dedupe: a recipient already carrying a
+            // txid is done, even though the entry as a whole is not.
+            if (pp.paidTxids.count(kv.first))
+                continue;
+            PayingRecord r;
+            r.blockHeight    = pp.blockHeight;
+            r.blockHash      = pp.blockHash;
+            r.matureAtHeight = pp.matureAtHeight;
+            r.address        = kv.first;
+            r.amount         = kv.second;
+            gPaying.push_back(r);
+            n++;
+        }
+        gQueuedPayouts.insert(id);
+        added += n;
+        LogPrint("payout", "[payout] block height %d matured -- queuing payout %s"
+                 " (%zu of %zu recipients still owed)\n",
+                 pp.matureAtHeight, id.c_str(), n, pp.amounts.size());
+    }
+    if (added) SavePayingLocked();
+}
+
+// Identity of a payment, for finding its record again after SendMoney.
+// amounts is a map keyed by address, so (block, address) is already unique.
+static bool SamePayment(const PayingRecord& a, const PayingRecord& b)
+{
+    return a.matureAtHeight == b.matureAtHeight
+        && a.blockHash      == b.blockHash
+        && a.address        == b.address
+        && a.amount         == b.amount;
+}
+
+// Settle a payment: it is either done or abandoned, either way it stops being
+// in flight. Note this only retires the working record -- whether the miner is
+// still OWED the money is the ledger's business, and the ledger is updated
+// separately by RecordPayoutTxid().
+static void ForgetPayment(const PayingRecord& r)
+{
+    std::lock_guard<std::mutex> lk(gPayoutExecMutex);
+    for (auto it = gPaying.begin(); it != gPaying.end(); ++it)
+        if (SamePayment(*it, r)) { gPaying.erase(it); break; }
+
+    // When the last record for a round is gone the round is no longer in
+    // flight, so a later flush may explode it again if the ledger still shows
+    // recipients owed (a give-up, for instance, leaves the entry standing).
+    bool stillInFlight = false;
+    for (const auto& e : gPaying)
+        if (e.blockHash == r.blockHash) { stillInFlight = true; break; }
+    if (!stillInFlight)
+        gQueuedPayouts.erase(PayoutIdForBlock(r.blockHeight, r.blockHash));
+
+    SavePayingLocked();
+}
+
+// Persist an updated attempt count / backoff for a payment still owed.
+static void ReschedulePayment(const PayingRecord& r)
+{
+    std::lock_guard<std::mutex> lk(gPayoutExecMutex);
+    for (auto& e : gPaying)
+        if (SamePayment(e, r)) {
+            e.retries      = r.retries;
+            e.deferrals    = r.deferrals;
+            e.retryAfter   = r.retryAfter;
+            // Carry the cleared probe flag back, or every retry re-scans the
+            // whole wallet -- the cost this merge is specifically removing.
+            e.fProbeWallet = r.fProbeWallet;
+            break;
+        }
+    SavePayingLocked();
+}
+
+// Record that a recipient has been paid, in the ledger, which is the only
+// durable statement that the debt is settled.
+//
+// The file write happens with gPayoutLedgerMutex RELEASED. Upstream calls
+// SavePendingPayoutsLocked() inside the per-recipient loop with the mutex
+// held, so every recipient costs the event loop a full serialise+fsync it has
+// to wait for in FlushMaturePayouts.
+static void RecordPayoutTxid(const PayingRecord& r, const std::string& txid)
+{
+    std::string blob;
+    bool complete = false;
+    {
+        std::lock_guard<std::mutex> lk(gPayoutLedgerMutex);
+        for (auto it = gPendingPayouts.begin(); it != gPendingPayouts.end(); ++it) {
+            if (it->blockHash != r.blockHash)
+                continue;
+            it->paidTxids[r.address] = txid;
+            it->retryAfter = 0;
+            if (PayoutFullyPaid(*it)) {
+                LogPrint("payout", "[payout] payout for block %d complete --"
+                         " removing from ledger\n", it->blockHeight);
+                gPendingPayouts.erase(it);
+                complete = true;
+            }
+            break;
+        }
+        blob = SerializePendingPayoutsLocked();
+    }
+    WritePendingPayoutsFile(blob);
+    // The round proof records a txid per address, so this is per recipient and
+    // not only on completion.
+    MarkPoolRoundPaid(PayoutIdForBlock(r.blockHeight, r.blockHash), r.address, txid);
+    if (complete)
+        LogPrint("payout", "[payout] block %d fully settled\n", r.blockHeight);
+}
+
+// Write a recipient off. Only reached after the full retry budget against a
+// block that is still on the main chain with coin available to spend, i.e. a
+// wallet fault rather than a maturity or reorg question.
+//
+// The amount is removed from the entry rather than marked paid, so the money
+// is not reported as sent. Once nothing is left owed the entry retires.
+static void ForfeitPayoutRecipient(const PayingRecord& r)
+{
+    std::string blob;
+    {
+        std::lock_guard<std::mutex> lk(gPayoutLedgerMutex);
+        for (auto it = gPendingPayouts.begin(); it != gPendingPayouts.end(); ++it) {
+            if (it->blockHash != r.blockHash)
+                continue;
+            it->amounts.erase(r.address);
+            if (it->amounts.empty() || PayoutFullyPaid(*it))
+                gPendingPayouts.erase(it);
+            break;
+        }
+        blob = SerializePendingPayoutsLocked();
+    }
+    WritePendingPayoutsFile(blob);
 }
 
-// Payout execution thread: drains gPayoutExecQueue, calls SendMoney.
+// Payout execution thread: works through gPaying, calls SendMoney.
 // Runs independently of the event loop so slow wallet operations
 // (SendMoney takes cs_main) never stall miner I/O.
 static void PayoutThreadFn(void*)
@@ -728,103 +1284,150 @@ static void PayoutThreadFn(void*)
     LogPrint("payout", "[payout] payout thread started\n");
 
     while (!fShutdown && gPoolRunning) {
-        std::vector<PendingPayout> batch;
+        std::vector<PayingRecord> batch;
         {
             std::lock_guard<std::mutex> lk(gPayoutExecMutex);
-            batch.swap(gPayoutExecQueue);
+            int64 now = GetTime();
+            for (const auto& r : gPaying)
+                if (r.retryAfter <= now)
+                    batch.push_back(r);
         }
 
-        for (auto& ppQueued : batch) {
-            LogPrint("payout", "[payout] executing payments for block matured at %d"
-                     " (%zu miners)\n", ppQueued.matureAtHeight, ppQueued.amounts.size());
-            bool fAbortBatch = false;
-            for (auto& kv : ppQueued.amounts) {
+        for (PayingRecord r : batch) {
+            const std::string id = PayoutIdForBlock(r.blockHeight, r.blockHash);
+
+            // Re-check here and not only at maturity: a payment can sit in this
+            // list for hours across retries, and the reorg that kills its
+            // funding block can land at any point in that window. Upstream has
+            // no equivalent -- it decides once, when the entry matures.
+            if (!PayoutBlockStillOnChain(r.blockHash)) {
+                LogPrint("payout", "[payout] block %d (%s) orphaned while queued"
+                         " -- dropping %s to %s\n",
+                         r.blockHeight, r.blockHash.ToString().substr(0, 14).c_str(),
+                         FormatMoney(r.amount).c_str(), r.address.c_str());
+                ForgetPayment(r);
+                continue;
+            }
+
+            // Upstream's per-recipient dedupe, against the ledger rather than
+            // against the batch: if a txid is already recorded for this
+            // address, the money went out and nothing more is owed.
+            {
                 bool alreadyPaid = false;
                 {
                     std::lock_guard<std::mutex> lk(gPayoutLedgerMutex);
                     for (const PendingPayout& pp : gPendingPayouts)
-                        if (pp.id == ppQueued.id && pp.paidTxids.count(kv.first))
+                        if (pp.blockHash == r.blockHash && pp.paidTxids.count(r.address)) {
                             alreadyPaid = true;
+                            break;
+                        }
                 }
-                if (alreadyPaid)
+                if (alreadyPaid) {
+                    ForgetPayment(r);
                     continue;
-
-                uint160 h160;
-                if (!AddressToHash160(kv.first, h160)) {
-                    // Should not happen -- bad addresses are filtered in QueuePayouts
-                    LogPrint("payout", "[payout] SKIPPED bad address '%s'\n",
-                             kv.first.c_str());
-                    continue;
-                }
-                CScript sc;
-                sc << OP_DUP << OP_HASH160 << h160 << OP_EQUALVERIFY << OP_CHECKSIG;
-                CWalletTx wtx;
-                wtx.mapValue["comment"] = strprintf("Pool payout height %d", ppQueued.matureAtHeight);
-                wtx.mapValue["pool_payout_id"] = ppQueued.id;
-                wtx.mapValue["pool_payout_address"] = kv.first;
-                wtx.mapValue["pool_payout_amount"] = strprintf("%lld", kv.second);
-
-                std::string txid;
-                if (FindRecordedPoolPayout(ppQueued.id, kv.first, kv.second, txid))
-                {
-                    LogPrint("payout", "[payout] recovered recorded payout %s to %s"
-                             " from wallet tx %s\n",
-                             FormatMoney(kv.second).c_str(), kv.first.c_str(), txid.c_str());
-                    MarkPoolRoundPaid(ppQueued.id, kv.first, txid);
-                }
-                else if (SendMoney(sc, kv.second, wtx))
-                {
-                    txid = wtx.GetHash().GetHex();
-                    LogPrint("payout", "[payout] paid %s to %s\n",
-                              FormatMoney(kv.second).c_str(), kv.first.c_str());
-                    MarkPoolRoundPaid(ppQueued.id, kv.first, txid);
-                }
-                else
-                {
-                    LogPrint("payout", "[payout] FAILED to pay %s to %s"
-                              " (insufficient funds or wallet locked?)\n",
-                              FormatMoney(kv.second).c_str(), kv.first.c_str());
-                    std::lock_guard<std::mutex> lk(gPayoutLedgerMutex);
-                    for (PendingPayout& pp : gPendingPayouts)
-                        if (pp.id == ppQueued.id)
-                            pp.nextAttempt = GetTime() + 60;
-                    SavePendingPayoutsLocked();
-                    fAbortBatch = true;
-                    break;
                 }
+            }
 
-                {
-                    std::lock_guard<std::mutex> lk(gPayoutLedgerMutex);
-                    for (PendingPayout& pp : gPendingPayouts) {
-                        if (pp.id != ppQueued.id)
-                            continue;
-                        pp.paidTxids[kv.first] = txid;
-                        pp.nextAttempt = 0;
-                        SavePendingPayoutsLocked();
-                        break;
-                    }
+            uint160 h160;
+            if (!AddressToHash160(r.address, h160)) {
+                // Should not happen -- bad addresses are filtered in QueuePayouts
+                LogPrint("payout", "[payout] SKIPPED bad address '%s'\n",
+                         r.address.c_str());
+                ForgetPayment(r);
+                continue;
+            }
+            CScript sc;
+            sc << OP_DUP << OP_HASH160 << h160 << OP_EQUALVERIFY << OP_CHECKSIG;
+
+            // Did a previous process send this and die before recording it?
+            // Only asked once per record -- see PayingRecord::fProbeWallet.
+            if (r.fProbeWallet) {
+                std::string recovered;
+                r.fProbeWallet = false;
+                if (FindRecordedPoolPayout(id, r.address, r.amount, recovered)) {
+                    LogPrint("payout", "[payout] recovered recorded payout %s to %s"
+                             " from wallet tx %s -- not resending\n",
+                             FormatMoney(r.amount).c_str(), r.address.c_str(),
+                             recovered.c_str());
+                    RecordPayoutTxid(r, recovered);
+                    ForgetPayment(r);
+                    continue;
                 }
             }
 
-            {
-                std::lock_guard<std::mutex> ledger(gPayoutLedgerMutex);
-                for (auto it = gPendingPayouts.begin(); it != gPendingPayouts.end(); ) {
-                    if (it->id == ppQueued.id && PayoutFullyPaid(*it)) {
-                        LogPrint("payout", "[payout] payout %s complete -- removing from ledger\n",
-                                 it->id.c_str());
-                        it = gPendingPayouts.erase(it);
-                        SavePendingPayoutsLocked();
-                    } else {
-                        ++it;
-                    }
-                }
+            // Waiting for coin to mature is not a failure, so it must not
+            // consume the retry budget. Burning a retry every 60s means a
+            // payment the pool fully intends to honour can hit GIVING UP
+            // 24h later purely because the subsidy funding it had not
+            // matured yet -- the miner is then silently never paid.
+            int64 nSpendable = GetBalance();
+            if (nSpendable < r.amount) {
+                r.deferrals++;
+                r.retryAfter = GetTime() + 60;
+                // Hourly, not every minute: a dry pool would otherwise
+                // write one line per payment per minute forever.
+                if (r.deferrals == 1 || r.deferrals % 60 == 0)
+                    LogPrint("payout", "[payout] deferring %s to %s -- only %s"
+                             " spendable (waiting %d min so far)\n",
+                             FormatMoney(r.amount).c_str(), r.address.c_str(),
+                             FormatMoney(nSpendable).c_str(), r.deferrals);
+                ReschedulePayment(r);
+                continue;
             }
-            {
-                std::lock_guard<std::mutex> lk(gPayoutExecMutex);
-                gQueuedPayouts.erase(ppQueued.id);
+
+            CWalletTx wtx;
+            wtx.mapValue["comment"] = PayoutComment(r.blockHeight);
+            // Upstream's structured metadata. This is what makes the wallet
+            // probe above possible at all -- the old comment-only form could
+            // not distinguish two rounds paying the same address the same
+            // amount. Keyed by the hash-derived id, so a reorg cannot make one
+            // round's transaction answer for another's.
+            wtx.mapValue["pool_payout_id"]      = id;
+            wtx.mapValue["pool_payout_address"] = r.address;
+            wtx.mapValue["pool_payout_amount"]  = strprintf("%lld", r.amount);
+
+            if (SendMoney(sc, r.amount, wtx)) {
+                // The wallet holds the transaction before this returns, so a
+                // crash between here and the ledger write is recoverable: the
+                // probe above finds it by id+address+amount and does not
+                // resend. Ledger first, in-flight record second -- the debt is
+                // described by at least one of them at every instant.
+                RecordPayoutTxid(r, wtx.GetHash().GetHex());
+                ForgetPayment(r);
+                LogPrint("payout", "[payout] paid %s to %s (tx %s)\n",
+                         FormatMoney(r.amount).c_str(), r.address.c_str(),
+                         wtx.GetHash().ToString().substr(0, 12).c_str());
+            } else if (r.retries < 1440) {
+                // Transient failures (reorg, locked wallet) must not silently
+                // burn the payment -- retry with backoff. Insufficient funds
+                // never lands here; it defers above.
+                r.retries++;
+                r.retryAfter = GetTime() + 60;
+                ReschedulePayment(r);
+                LogPrint("payout", "[payout] FAILED to pay %s to %s"
+                         " (%s spendable at the time) -- retry %d/1440 in 60s\n",
+                         FormatMoney(r.amount).c_str(), r.address.c_str(),
+                         FormatMoney(nSpendable).c_str(), r.retries);
+            } else {
+                // Reaching here means 1440 attempts that were NOT
+                // insufficient-funds waits (those defer instead) against a
+                // block still on the main chain -- i.e. a real wallet fault,
+                // not a maturity or reorg question.
+                LogPrint("payout", "[payout] GIVING UP on %s to %s after %d"
+                         " retries -- block %d is still on-chain and %s was"
+                         " spendable, so this is a wallet fault, not maturity"
+                         " -- payment forfeited\n",
+                         FormatMoney(r.amount).c_str(), r.address.c_str(),
+                         r.retries, r.blockHeight,
+                         FormatMoney(nSpendable).c_str());
+                // Write the debt off in the ledger as well as dropping the
+                // in-flight record. Under the survives-until-fully-paid model
+                // the entry would otherwise never complete, and every later
+                // flush would explode it again -- a forfeit that silently
+                // becomes an infinite retry.
+                ForfeitPayoutRecipient(r);
+                ForgetPayment(r);
             }
-            if (fAbortBatch)
-                continue;
         }
 
         Sleep(500); // check for new work every 500ms
@@ -1044,6 +1647,45 @@ static void PushReady(btf_socket_t s)
     gReadyQueue.push_back(s);
 }
 
+// Loopback stratum listener: lets a miner running on the SAME machine reach
+// this pool over plain TCP (127.0.0.1:8334), skipping the .btf rendezvous
+// entirely. The rendezvous relay only allows one service registration per
+// pubkey, so the pool service and the node's own peer-accept fight over the
+// node identity at the relay -- loopback avoids that fight for local miners.
+static void LocalAcceptFn(void*)
+{
+    SOCKET ls = socket(AF_INET, SOCK_STREAM, IPPROTO_TCP);
+    if (ls == INVALID_SOCKET)
+        return;
+    int yes = 1;
+    setsockopt(ls, SOL_SOCKET, SO_REUSEADDR, (char*)&yes, sizeof(yes));
+    struct sockaddr_in addr;
+    memset(&addr, 0, sizeof(addr));
+    addr.sin_family = AF_INET;
+    addr.sin_addr.s_addr = htonl(INADDR_LOOPBACK);
+    addr.sin_port = htons(8334);
+    if (bind(ls, (struct sockaddr*)&addr, sizeof(addr)) != 0 || listen(ls, 16) != 0)
+    {
+        LogPrint("pool", "[pool] loopback stratum bind/listen failed on 127.0.0.1:8334\n");
+        closesocket(ls);
+        return;
+    }
+    LogPrint("pool", "[pool] loopback stratum listening on 127.0.0.1:8334\n");
+    while (!fShutdown && gPoolRunning)
+    {
+        SOCKET c = accept(ls, NULL, NULL);
+        if (c == INVALID_SOCKET)
+        {
+            if (fShutdown || !gPoolRunning)
+                break;
+            continue;
+        }
+        LogPrint("pool", "[pool] miner arrived via loopback -- pushing to event loop\n");
+        PushReady((btf_socket_t)c);
+    }
+    closesocket(ls);
+}
+
 // ---------------------------------------------------------------------------
 // I/O helpers -- event loop thread only
 // ---------------------------------------------------------------------------
@@ -1480,7 +2122,11 @@ static bool HandleLine(Miner* m, const std::string& rawLine,
         if (accepted) {
             // Snapshot height before RebuildJob() (which increments it)
             int foundHeight = gCurrentJob.height;
-            QueuePayouts(foundHeight, b.GetHash().GetHex(), b.vtx[0].GetHash().GetHex(),
+            // b is the block we submitted, untouched by ProcessBlock (which
+            // took a copy), so its hash is what the payout must be keyed on.
+            // Passed as a uint256, not hex: the ledger key must stay a real
+            // hash. The remaining arguments are upstream's round-proof data.
+            QueuePayouts(foundHeight, b.GetHash(), b.vtx[0].GetHash().GetHex(),
                          b.vtx[0].vout[0].nValue, m->address,
                          roundShareCount, roundShareTotal);
             // Reset round shares
@@ -1962,7 +2608,11 @@ static void AcceptOneFn(void* arg)
     LogPrint("pool", "[pool] accept thread started for relay %s\n", relay.c_str());
 
     while (!fShutdown && gPoolRunning) {
-        // Blocks until a miner connects to us at this relay
+        // Advertise this relay as the pool's meeting node BEFORE registering,
+        // so that miners which resolve our descriptor find a relay where the
+        // pool (not the node's peer-accept) holds the registration.
+        BtfSetActiveRelay(relay);
+        // Returns as soon as the relay lists us -- registered, not yet paired.
         btf::RvSocket rv = btf::RvServiceRegister(host.c_str(), (unsigned short)port, pk);
 
         if (fShutdown || !gPoolRunning) {
@@ -1976,6 +2626,23 @@ static void AcceptOneFn(void* arg)
             continue;
         }
 
+        // Block for a miner to actually arrive. RvServiceRegister used to do
+        // this itself and returned with the relay's 0x01 pairing byte already
+        // consumed; it no longer does. Without waiting here, BtfServiceWrap
+        // reads that 0x01 as the first byte of the miner's 32-byte ephemeral
+        // key -- every subsequent byte is shifted by one, so the X25519
+        // handshake completes against a garbage shared secret (it has no
+        // confirmation step to catch it), the tunnel is handed to the event
+        // loop, and the miner's mining.subscribe never decrypts into a valid
+        // line. The miner sees the pool close on it; the pool sees a peer that
+        // never authorized.
+        if (!btf::RvServiceWaitPaired(rv)) {
+            btf::RvClose(rv);
+            LogPrint("pool", "[pool] relay %s: dropped us before any miner dialed"
+                     " -- re-registering\n", relay.c_str());
+            continue;
+        }
+
         // Echan handshake -- blocking but fast (local + relay round-trip)
         btf_socket_t fd = btf::BtfServiceWrap(rv, sk);
         if (fd == INVALID_SOCKET) {
@@ -2062,8 +2729,14 @@ void ThreadRPCServer(void*)
 
     LoadPendingPayouts();
     LoadPoolRounds();
+    LoadPaying();
+    // Must run before the payout thread starts, so nothing is resent that the
+    // ledger already shows as sent, and every restored in-flight record is
+    // armed for its one wallet probe before it is allowed to send.
+    ReconcilePayouts();
 
     _beginthread(AcceptLoopFn, 0, NULL);
+    _beginthread(LocalAcceptFn, 0, NULL);
     _beginthread(ThreadBtfPoolAnnouncer, 0, NULL);
     _beginthread(PayoutThreadFn, 0, NULL);